According to onchain investigator ZachXBT, French cooperative bank Crédit Mutuel Arkéa has been identified as the alleged victim of a cryptocurrency theft totaling more than $133 million. He named the bank on November 3, 2026, after tracing withdrawals from several centralized exchange accounts. The allegation rests on his analysis, rather than on confirmation from the bank or authorities.
Summary
Key takeaways
- ZachXBT traced an additional $27 million after his initial report.
- The alleged withdrawals involved USDC and USDT.
- Funds moved through instant exchanges, Monero conversions and blockchain bridges.
- Kraken restricted associated accounts and denied a breach of its systems.
How the Crédit Mutuel Arkéa theft estimate reached $133 million
ZachXBT raised his estimate from more than $106 million to above $133 million after identifying another $27 million in exchange withdrawals. Some of those transactions took place after he first disclosed the incident.
His initial report, published on November 2, described losses at an unidentified European Union entity through withdrawals made the previous day. The funds left multiple centralized exchange accounts in USDC and USDT.
On the evening of November 3, he identified Crédit Mutuel Arkéa as the alleged victim. The bank serves more than 5.6 million customers and holds €211.5 billion in total assets, approximately $237 billion.
Tracing swaps, instant exchanges and blockchain bridges
The attack lasted several days, ZachXBT said, and his estimate potentially excludes additional losses connected with over-the-counter activity.
In his November 2 Telegram message, he described the attacker rapidly exchanging USDC for ETH and sending funds through instant exchanges, including WellWallet and Kyrrex. The route also involved converting funds into Monero (XMR) through Wagyu and using bridges to move assets between blockchains.
His account of the alleged Crédit Mutuel Arkéa theft therefore extends beyond the original exchange withdrawals to subsequent conversions and cross-chain transfers.
ZachXBT challenges disclosure and rules out a Lazarus link
ZachXBT said he had a “high degree of confidence” that the attacker was not connected to North Korea’s Lazarus Group. That assessment remains the investigator’s attribution, not a finding announced by authorities.
He also criticized the institution’s handling of disclosure, alleging that delays allowed more than $30 million to be laundered. In his assessment, proper notification of EU law enforcement would have enabled the funds to be frozen.
Exchange restrictions and the bank’s response
Kraken restricted accounts associated with the incident and said neither its systems nor its customer accounts had been compromised. Crypto.com also acted to block related funds, while OKX began reviewing the allegations.
As of November 4, Crédit Mutuel Arkéa had issued no public statement confirming or denying the alleged theft. The loss estimate, transaction tracing and attribution remained based on ZachXBT’s investigation, without independent verification by the bank or authorities.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
